UBUNTU-CVE-2026-101901

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-101901

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101901.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-101901

Upstream

CVE-2026-101901

Published

2026-09-28T18:17:00Z

Modified

2026-09-30T21:41:53Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.

References

Affected packages

Ubuntu:Pro:20.04:LTS / node-axios

Package

Name: node-axios
Purl: pkg:deb/ubuntu/node-axios?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.19.0+dfsg-2

0.19.0+dfsg-2ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-axios",
            "binary_version":  "0.19.0+dfsg-2ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101901.json"

Ubuntu:Pro:22.04:LTS / node-axios

Package

Name: node-axios
Purl: pkg:deb/ubuntu/node-axios?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.21.1+dfsg-1

0.23.0+dfsg-2

0.24.0+dfsg-1

0.25.0+dfsg-2

0.26.0+dfsg-1

0.26.0+dfsg-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-axios",
            "binary_version":  "0.26.0+dfsg-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101901.json"

Ubuntu:Pro:24.04:LTS / node-axios

Package

Name: node-axios
Purl: pkg:deb/ubuntu/node-axios?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.1+dfsg-1

1.5.1+dfsg-1

1.6.2+dfsg-1

1.6.8+dfsg-2

1.6.8+dfsg-2ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-axios",
            "binary_version":  "1.6.8+dfsg-2ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101901.json"

Ubuntu:Pro:26.04:LTS / node-axios

Package

Name: node-axios
Purl: pkg:deb/ubuntu/node-axios?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.11.0+dfsg-1

1.12.1+dfsg-1

1.13.2+dfsg-1build1

1.13.2+dfsg-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-axios",
            "binary_version":  "1.13.2+dfsg-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101901.json"